@@ -17,24 +17,98 @@ describe('cookie.serialize(name, value)', function () {
17
17
assert . equal ( cookie . serialize ( 'foo' , '' ) , 'foo=' )
18
18
} )
19
19
20
+ it ( 'should serialize valid name' , function ( ) {
21
+ var validNames = [
22
+ 'foo' ,
23
+ 'foo!bar' ,
24
+ 'foo#bar' ,
25
+ 'foo$bar' ,
26
+ "foo'bar" ,
27
+ 'foo*bar' ,
28
+ 'foo+bar' ,
29
+ 'foo-bar' ,
30
+ 'foo.bar' ,
31
+ 'foo^bar' ,
32
+ 'foo_bar' ,
33
+ 'foo`bar' ,
34
+ 'foo|bar' ,
35
+ 'foo~bar' ,
36
+ 'foo7bar' ,
37
+ ] ;
38
+
39
+ validNames . forEach ( ( name ) => {
40
+ assert . equal ( cookie . serialize ( name , 'baz' ) , `${ name } =baz` , `Expected serialized value for name: "${ name } "` ) ;
41
+ } ) ;
42
+ } ) ;
43
+
20
44
it ( 'should throw for invalid name' , function ( ) {
21
- assert . throws ( cookie . serialize . bind ( cookie , 'foo\n' , 'bar' ) , / a r g u m e n t n a m e i s i n v a l i d / )
22
- assert . throws ( cookie . serialize . bind ( cookie , 'foo\u280a' , 'bar' ) , / a r g u m e n t n a m e i s i n v a l i d / )
23
- assert . throws ( cookie . serialize . bind ( cookie , 'foo bar' , 'bar' ) , / a r g u m e n t n a m e i s i n v a l i d / )
24
- } )
25
- } )
45
+ var invalidNames = [
46
+ 'foo\n' ,
47
+ 'foo\u280a' ,
48
+ 'foo/foo' ,
49
+ 'foo,foo' ,
50
+ 'foo;foo' ,
51
+ 'foo@foo' ,
52
+ 'foo[foo]' ,
53
+ 'foo?foo' ,
54
+ 'foo:foo' ,
55
+ 'foo!foo' ,
56
+ 'foo{foo}' ,
57
+ 'foo foo' ,
58
+ 'foo\tfoo' ,
59
+ 'foo"foo' ,
60
+ 'foo<script>foo'
61
+ ] ;
62
+
63
+ invalidNames . forEach ( ( name ) => {
64
+ assert . throws (
65
+ cookie . serialize . bind ( cookie , name , 'bar' ) ,
66
+ / a r g u m e n t n a m e i s i n v a l i d / ,
67
+ `Expected an error for invalid name: "${ name } "`
68
+ ) ;
69
+ } ) ;
70
+ } ) ;
71
+ } ) ;
26
72
27
73
describe ( 'cookie.serialize(name, value, options)' , function ( ) {
28
74
describe ( 'with "domain" option' , function ( ) {
29
- it ( 'should serialize domain' , function ( ) {
30
- assert . equal ( cookie . serialize ( 'foo' , 'bar' , { domain : 'example.com' } ) ,
31
- 'foo=bar; Domain=example.com' )
32
- } )
33
75
34
- it ( 'should throw for invalid value' , function ( ) {
35
- assert . throws ( cookie . serialize . bind ( cookie , 'foo' , 'bar' , { domain : 'example.com\n' } ) ,
36
- / o p t i o n d o m a i n i s i n v a l i d / )
37
- } )
76
+ it ( 'should serialize valid domain' , function ( ) {
77
+ const validDomains = [
78
+ 'example.com' ,
79
+ 'sub.example.com' ,
80
+ 'my-site.org' ,
81
+ 'localhost'
82
+ ] ;
83
+
84
+ validDomains . forEach ( ( domain ) => {
85
+ assert . equal (
86
+ cookie . serialize ( 'foo' , 'bar' , { domain } ) ,
87
+ `foo=bar; Domain=${ domain } ` ,
88
+ `Expected serialized value for domain: "${ domain } "`
89
+ ) ;
90
+ } ) ;
91
+ } ) ;
92
+
93
+ it ( 'should throw for invalid domain' , function ( ) {
94
+ const invalidDomains = [
95
+ 'example.com\n' ,
96
+ 'sub.example.com\u0000' ,
97
+ 'my site.org' ,
98
+ 'domain..com' ,
99
+ '.example.com' ,
100
+ 'example.com; Path=/' ,
101
+ 'example.com /* inject a comment */'
102
+ ] ;
103
+
104
+ invalidDomains . forEach ( ( domain ) => {
105
+ assert . throws (
106
+ cookie . serialize . bind ( cookie , 'foo' , 'bar' , { domain } ) ,
107
+ / o p t i o n d o m a i n i s i n v a l i d / ,
108
+ `Expected an error for invalid domain: "${ domain } "`
109
+ ) ;
110
+ } ) ;
111
+ } ) ;
38
112
} )
39
113
40
114
describe ( 'with "encode" option' , function ( ) {
@@ -133,14 +207,47 @@ describe('cookie.serialize(name, value, options)', function () {
133
207
134
208
describe ( 'with "path" option' , function ( ) {
135
209
it ( 'should serialize path' , function ( ) {
136
- assert . equal ( cookie . serialize ( 'foo' , 'bar' , { path : '/' } ) , 'foo=bar; Path=/' )
137
- } )
210
+ const validPaths = [
211
+ '/' ,
212
+ '/login' ,
213
+ '/foo.bar/baz' ,
214
+ '/foo-bar' ,
215
+ '/foo=bar?baz' ,
216
+ '/foo"bar"' ,
217
+ '/../foo/bar' ,
218
+ '../foo/' ,
219
+ './'
220
+ ] ;
221
+
222
+ validPaths . forEach ( ( path ) => {
223
+ assert . equal (
224
+ cookie . serialize ( 'foo' , 'bar' , { path } ) ,
225
+ `foo=bar; Path=${ path } ` ,
226
+ `Expected serialized value for path: "${ path } "`
227
+ ) ;
228
+ } ) ;
229
+ } ) ;
138
230
139
231
it ( 'should throw for invalid value' , function ( ) {
140
- assert . throws ( cookie . serialize . bind ( cookie , 'foo' , 'bar' , { path : '/\n' } ) ,
141
- / o p t i o n p a t h i s i n v a l i d / )
142
- } )
143
- } )
232
+ const invalidPaths = [
233
+ '/\n' ,
234
+ '/foo\u0000' ,
235
+ '/foo bar' ,
236
+ '/path/with\rnewline' ,
237
+ '/path\\with\\backslash' ,
238
+ '/; Path=/sensitive-data' ,
239
+ '/login"><script>alert(1)</script>'
240
+ ] ;
241
+
242
+ invalidPaths . forEach ( ( path ) => {
243
+ assert . throws (
244
+ cookie . serialize . bind ( cookie , 'foo' , 'bar' , { path } ) ,
245
+ / o p t i o n p a t h i s i n v a l i d / ,
246
+ `Expected an error for invalid path: "${ path } "`
247
+ ) ;
248
+ } ) ;
249
+ } ) ;
250
+ } ) ;
144
251
145
252
describe ( 'with "priority" option' , function ( ) {
146
253
it ( 'should throw on invalid priority' , function ( ) {
0 commit comments